# com-proxy-triage

Use this skill when the user wants to triage Windows COM proxy/hijack candidates by capturing `HKCU\Software\Classes\CLSID\{...}\InProcServer32` `NAME NOT FOUND` lookups for a process, mapping each CLSID to the machine-wide `HKLM\SOFTWARE\Classes\CLSID\{...}\InProcServer32` DLL, and optionally testing HKCU overrides with a Koppeling-style proxy DLL. Good for Zoom, Edge, and similar COM activation hunts.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/fe439743-2063-4501-9846-2a26fa45e7e9
- **API (JSON + files):** https://forefy.com/api/asr/fe439743-2063-4501-9846-2a26fa45e7e9

---

## SKILL.md

---
name: com-proxy-triage
description: Use this skill when the user wants to triage Windows COM proxy/hijack candidates by capturing `HKCU\Software\Classes\CLSID\{...}\InProcServer32` `NAME NOT FOUND` lookups for a process, mapping each CLSID to the machine-wide `HKLM\SOFTWARE\Classes\CLSID\{...}\InProcServer32` DLL, and optionally testing HKCU overrides with a Koppeling-style proxy DLL. Good for Zoom, Edge, and similar COM activation hunts.
metadata:
  author: "GhostWorks"
---

# COM Proxy Triage

## Overview

This skill captures live `OpenKey` misses for `*InProcServer32`, enriches them with the corresponding machine-wide `InProcServer32` DLL, and tests only CLSIDs that have a usable HKLM backing DLL.

Fresh hosts should start with `scripts/Initialize-ComHijackHost.ps1 -ValidateOnly`. If the `FAIL` rows show missing build prerequisites such as `MSBuild`, `VC x64 toolchain`, `Windows SDK`, or `vswhere`/Visual Studio Build Tools details, run `scripts/Initialize-ComHijackHost.ps1 -InstallBuildTools` and then rerun `-ValidateOnly` before full validation. Use `scripts/Watch-InProcServer32Misses.ps1` for the capture step, `scripts/Invoke-ComHijackProbe.ps1` for a low-level probe, `scripts/Invoke-ComHijackApp.ps1` for an app-name-first single-app run, `scripts/Invoke-ComHijackSurvey.ps1` for batch runs, and `scripts/Get-ComHijackOverlap.ps1` to analyze the running JSONL database. Read `references/workflow.md` when you need the concrete test loop, registry handling, or Koppeling build notes.

## Workflow

1. Run the watcher from an elevated PowerShell session and filter to the target process with `-ProcessName`.
2. Keep only `HKCU` `InProcServer32` misses where `MachineInprocServer32` is present.
3. Deduplicate by `Clsid`.
4. Build or reuse a proxy DLL that clones the HKLM target DLL's exports and runs the chosen payload.
5. Override `HKCU\Software\Classes\CLSID\{CLSID}\InProcServer32`, launch a fresh target process, and check whether the payload fired.
6. Restore the prior HKCU state after every test. If the key did not exist before, remove it.
7. Resolve installed apps by name first. Use `assets\apps.json` as an override cache when present, not as a required source of truth.

## Rules

- Ignore candidates that do not have a corresponding `MachineInprocServer32` value.
- Treat `0xC0000034` as `NAME NOT FOUND`.
- Prefer cold-start launches of the target app for each test.
- Record whether the payload fired and whether the proxy DLL was actually loaded.
- Never leave a test override behind unless the user explicitly asks to keep it.
- Treat the repo-local `Koppeling\` submodule as the primary proxy dependency. Only fall back to adjacent or `Documents\Codex` checkouts if the submodule is unavailable.
- Seed `Koppeling\Bin\NetClone.exe` from `assets\koppeling-netclone\` before trying to rebuild it on a fresh or offline host.
- Always write discovery artifacts even when the host is missing the VC toolchain for full payload validation.
- By default, validate every discovered candidate. Use `-MaxCandidates` only as an explicit throttle for faster spot checks.
- When `Initialize-ComHijackHost.ps1 -ValidateOnly` fails on build-toolchain checks (`MSBuild`, `VC x64 toolchain`, `Windows SDK`, or `vswhere`/Build Tools-related details), run `Initialize-ComHijackHost.ps1 -InstallBuildTools` before retrying full validation.
- Do not treat `-InstallBuildTools` as a fix for missing elevation, missing target apps, or other non-toolchain blockers; discovery-only runs remain valid when full validation is not possible.

## Database Snapshot

- Before pushing updates to `com-proxy-triage`, verify whether the published `COM-Proxy-Database` snapshot also needs to be refreshed.
- If the push changes probe behavior, result semantics, or dashboard-visible fields, update the local `COM-Proxy-Database` clone, run `scripts\Refresh-ComProxyDatabaseSnapshot.ps1`, and push that repo as part of the same publishing pass.
- Keep the published database snapshot aligned with the live dashboard metrics:
  `Active Apps`, `Unique CLSIDs`, `Unique DLLs`, `Shared DLLs`, and `Shared CLSIDs`.

Use this refresh step:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Refresh-ComProxyDatabaseSnapshot.ps1"
```

## Quick Start

Validate a fresh host first:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Initialize-ComHijackHost.ps1" -ValidateOnly
```

If the `FAIL` rows show missing `MSBuild`, `VC x64 toolchain`, `Windows SDK`, or `vswhere`/Build Tools-related details, install the toolchain:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Initialize-ComHijackHost.ps1" -InstallBuildTools
```

Then validate the host again before running the probe:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Initialize-ComHijackHost.ps1" -ValidateOnly
```

Use this watcher pattern:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Watch-InProcServer32Misses.ps1" -ProcessName Zoom -ResolveProcessName -DurationSeconds 30
```

The emitted JSON already includes:

- `Clsid`
- `Path`
- `MachineInprocServer32`

That is enough to pick candidates and drive the HKCU override loop in `references/workflow.md`.

Run any installed app by name:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Invoke-ComHijackApp.ps1" -AppName "Slack" -KillExisting
```

That default run tests every discovered candidate. Add `-MaxCandidates 5` or another positive limit only when you want a smaller sample.

Run a manifest-backed app:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Invoke-ComHijackApp.ps1" -AppName Zoom -KillExisting
```

To inspect CLSID overlap across everything already tested:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Get-ComHijackOverlap.ps1"
```

To run every app currently declared in the manifest:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Invoke-ComHijackSurvey.ps1" -KillExisting
```

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: "COM Proxy Triage"
  short_description: "Triage HKCU COM hijack candidates"
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  brand_color: '#00B36B'
  default_prompt: "Use $com-proxy-triage to capture HKCU InProcServer32 misses for a Windows process and test the first HKLM-backed CLSIDs with a proxy DLL."

policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/apps.json

```json
[
  {
    "AppName": "Zoom",
    "PackageId": "zoom",
    "ProcessName": "Zoom",
    "LaunchExecutable": "C:\\Program Files\\Zoom\\bin\\Zoom.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "zoom.exe"
    ]
  },
  {
    "AppName": "Edge",
    "PackageId": "microsoft-edge",
    "ProcessName": "msedge",
    "LaunchExecutable": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "msedge.exe"
    ]
  },
  {
    "AppName": "VSCode",
    "PackageId": "vscode",
    "ProcessName": "Code",
    "LaunchExecutable": "C:\\Users\\zach\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "code.exe"
    ]
  },
  {
    "AppName": "GoogleChrome",
    "PackageId": "googlechrome",
    "ProcessName": "chrome",
    "LaunchExecutable": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "chrome.exe"
    ]
  },
  {
    "AppName": "MicrosoftTeams",
    "PackageId": "microsoft-teams.install",
    "ProcessName": "ms-teams",
    "LaunchExecutable": "C:\\Users\\zach\\AppData\\Local\\Microsoft\\WindowsApps\\ms-teams.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "ms-teams.exe"
    ]
  },
  {
    "AppName": "TreeSizeFree",
    "PackageId": "treesizefree",
    "ProcessName": "TreeSizeFree",
    "LaunchExecutable": "C:\\Program Files\\JAM Software\\TreeSize Free\\TreeSizeFree.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "TreeSizeFree.exe"
    ]
  },
  {
    "AppName": "FoxitReader",
    "PackageId": "foxitreader",
    "ProcessName": "FoxitPDFReader",
    "LaunchExecutable": "C:\\Program Files\\Foxit Software\\Foxit PDF Reader\\FoxitPDFReader.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "FoxitPDFReader.exe"
    ]
  },
  {
    "AppName": "PaintDotNet",
    "PackageId": "paint.net",
    "ProcessName": "paintdotnet",
    "LaunchExecutable": "C:\\Program Files\\Paint.NET\\paintdotnet.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "paintdotnet.exe"
    ]
  },
  {
    "AppName": "WinRAR",
    "PackageId": "winrar",
    "ProcessName": "WinRAR",
    "LaunchExecutable": "C:\\Program Files\\WinRAR\\WinRAR.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "WinRAR.exe"
    ]
  },
  {
    "AppName": "TeamViewer",
    "PackageId": "teamviewer",
    "ProcessName": "TeamViewer",
    "LaunchExecutable": "C:\\Program Files\\TeamViewer\\TeamViewer.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "teamviewer.exe"
    ]
  },
  {
    "AppName": "NotepadPlusPlus",
    "PackageId": "notepadplusplus.install",
    "ProcessName": "notepad++",
    "LaunchExecutable": "C:\\Program Files\\Notepad++\\notepad++.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "notepad++.exe"
    ]
  },
  {
    "AppName": "SevenZip",
    "PackageId": "7zip.install",
    "ProcessName": "7zFM",
    "LaunchExecutable": "C:\\Program Files\\7-Zip\\7zFM.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "7zFM.exe"
    ]
  },
  {
    "AppName": "VLC",
    "PackageId": "vlc",
    "ProcessName": "vlc",
    "LaunchExecutable": "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "vlc.exe"
    ]
  },
  {
    "AppName": "Firefox",
    "PackageId": "firefox",
    "ProcessName": "firefox",
    "LaunchExecutable": "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "firefox.exe"
    ]
  },
  {
    "AppName": "AdobeReader",
    "PackageId": "adobereader",
    "ProcessName": "Acrobat",
    "LaunchExecutable": "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "acrobat.exe"
    ]
  },
  {
    "AppName": "Dropbox",
    "PackageId": "dropbox",
    "ProcessName": "Dropbox",
    "LaunchExecutable": "C:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "dropbox.exe"
    ]
  },
  {
    "AppName": "Slack",
    "PackageId": "slack",
    "ProcessName": "slack",
    "LaunchExecutable": "C:\\Program Files\\Slack\\slack.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "slack.exe"
    ]
  },
  {
    "AppName": "CCleaner",
    "PackageId": "ccleaner",
    "ProcessName": "CCleaner64",
    "LaunchExecutable": "C:\\Program Files\\CCleaner\\CCleaner64.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "CCleaner64.exe"
    ]
  },
  {
    "AppName": "LibreOffice",
    "PackageId": "libreoffice-fresh",
    "ProcessName": "soffice",
    "LaunchExecutable": "C:\\Program Files\\LibreOffice\\program\\soffice.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "soffice.exe"
    ]
  },
  {
    "AppName": "Wireshark",
    "PackageId": "wireshark",
    "ProcessName": "Wireshark",
    "LaunchExecutable": "C:\\Program Files\\Wireshark\\Wireshark.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "Wireshark.exe"
    ]
  },
  {
    "AppName": "CutePDF",
    "PackageId": "cutepdf",
    "ProcessName": "CutePDFWriter",
    "LaunchExecutable": "C:\\Program Files (x86)\\CutePDF Writer\\CutePDFWriter.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "CutePDFWriter.exe"
    ]
  },
  {
    "AppName": "CitrixWorkspace",
    "PackageId": "citrix-workspace",
    "ProcessName": "nglauncher",
    "LaunchExecutable": "C:\\Program Files\\Citrix\\Secure Access Client\\nglauncher.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "nglauncher.exe",
      "CtxsDPS.exe",
      "nsepa.exe"
    ]
  },
  {
    "AppName": "BoxDrive",
    "PackageId": "box-drive",
    "ProcessName": "BoxUI",
    "LaunchExecutable": "C:\\Program Files\\Box\\Box\\UI\\BoxUI.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "BoxUI.exe",
      "Box.Desktop.UpdateService.exe"
    ]
  },
  {
    "AppName": "Webex",
    "PackageId": "webex",
    "ProcessName": "CiscoCollabHost",
    "LaunchExecutable": "C:\\Users\\zach\\AppData\\Local\\Programs\\Cisco Spark\\CiscoCollabHost.exe",
    "LaunchArgumentList": [],
    "TargetProcesses": [
      "CiscoCollabHost.exe"
    ]
  }
]
```

## assets/icon.png

```

```

## assets/icon.svg

```

```

## assets/koppeling-netclone

```

```

## assets/koppeling-netclone/CommandLine.dll

```

```

## assets/koppeling-netclone/NetClone.exe

```

```

## assets/koppeling-netclone/NetClone.exe.config

```

```

## assets/koppeling-netclone/PeNet.Asn1.dll

```

```

## assets/koppeling-netclone/PeNet.dll

```

```

## assets/koppeling-netclone/System.Security.Cryptography.Pkcs.dll

```

```

## assets/koppeling-netclone/Validation.dll

```

```

## assets/koppeling-netclone/Xunit.SkippableFact.dll

```

```

## assets/koppeling-netclone/xunit.abstractions.dll

```

```

## assets/koppeling-netclone/xunit.core.dll

```

```

## assets/koppeling-netclone/xunit.execution.desktop.dll

```

```

## assets/theif-main-template.cpp

```

```

## references

```

```

## references/workflow.md

# Workflow

## Capture

Run the bundled watcher from an elevated PowerShell session:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File ".\scripts\Watch-InProcServer32Misses.ps1" -ProcessName Zoom -ResolveProcessName -DurationSeconds 30
```

The watcher polls a live ETW registry trace and prints one JSON object per matching `OpenKey` miss where:

- `Status == 0xC0000034`
- the path ends with `InProcServer32`
- the process name matches `-ProcessName` if supplied

Each event includes the parsed `Clsid` and the machine-wide `HKLM\SOFTWARE\Classes\CLSID\{...}\InProcServer32` default value as `MachineInprocServer32`.

## Candidate Selection

1. Keep only paths under the current user's `HKCU\Software\Classes\CLSID\{...}\InProcServer32` equivalent.
2. Drop any event where `MachineInprocServer32` is empty.
3. Deduplicate by `Clsid`.
4. Test candidates one at a time from a fresh target launch.

## Proxy Build

Use a local Koppeling checkout when available.

Expected pattern:

1. Patch `Koppeling\Theif\main.cpp` so the payload only runs inside the target process.
2. Build the Koppeling payload DLL.
3. Clone the target HKLM DLL's exports onto the payload DLL with `NetClone`.

The payload used during development was `calc.exe`.

The codified path now is:

1. Use `scripts\Build-KoppelingPayload.ps1` with one or more target process names.
2. Let it generate `Koppeling\Theif\main.cpp` from `assets\theif-main-template.cpp`.
3. Build `Theif.dll`.
4. Restore the original `main.cpp`.

## HKCU Override Loop

The per-user override key is:

```text
HKEY_CURRENT_USER\Software\Classes\CLSID\{CLSID}\InProcServer32
```

For each candidate:

1. Read and save the existing HKCU default value and `ThreadingModel`.
2. Set the default value to the proxy DLL path.
3. Set a compatible `ThreadingModel` such as `Both` if needed.
4. Launch a fresh target process.
5. Check whether the payload fired and whether the proxy DLL loaded.
6. Restore the old HKCU values, or delete the key if it did not exist before the test.

## Config-Driven Runs

Prefer the manifest in `assets\apps.json` over inferring launch paths in chat.

Current wrappers:

- `scripts\Invoke-ComHijackApp.ps1`
- `scripts\Invoke-ComHijackSurvey.ps1`

These wrappers:

- load the app spec from the manifest
- build a target-specific payload DLL
- run the probe script
- append results into the JSONL database

## scripts

```

```

## scripts/Build-KoppelingPayload.ps1

```

```

## scripts/Build-LoadLibraryProxy.ps1

```

```

## scripts/ComHijackApp.Common.ps1

```

```

## scripts/ComHijackHost.Common.ps1

```

```

## scripts/Get-ComHijackOverlap.ps1

```

```

## scripts/Initialize-ComHijackHost.ps1

```

```

## scripts/Invoke-ComHijackApp.ps1

```

```

## scripts/Invoke-ComHijackProbe.ps1

```

```

## scripts/Invoke-ComHijackSurvey.ps1

```

```

## scripts/Refresh-ComProxyDatabaseSnapshot.ps1

```

```

## scripts/Watch-InProcServer32Misses.ps1

```

```